An interaction between Google Analytics and Django’s cookie parsing could allow
an attacker to set arbitrary cookies leading to a bypass of CSRF protection.

The parser for request.COOKIES is simplified to better match the behavior
of browsers and to mitigate this attack. request.COOKIES may now contain
cookies that are invalid according to RFC 6265 but are possible to set via
document.cookie.